All Apps and Add-ons

How to show majorUnit and minorUnit on x-axis?

royimad
Builder

I need to draw a chart with 2 values on x-axis , how to do that?
Herby the code sample that i'm using:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Web Services Trends</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Sum of Claims" autoRun="True">
    <param name="savedSearch">RELEASECHECK2</param>

    <module name="HiddenChartFormatter">
        <param name="chart">line</param>
        <option name="charting.axisX">time</option>
        <param name="charting.axislabelsX.majorUnit">RELEASEDATE</param>
        <param name="charting.axislabelsX.minorUnit">RELEASENAME</param>
        <param name="charting.axislabelsY.majorUnit">data</param>
        <param name="charting.axislabelsY.minorUnit">data</param>

        <!--
        <param name="layout.axisLabelsX.minorTickVisibility">yes</param>
        <param name="layout.axisLabelsX.majorTickVisibility">yes</param>
        -->

        <option name="charting.axisX.comparator">RELEASENAME</option>

        <param name="primaryAxisTitle.text">x axis name</param>
        <param name="secondaryAxisTitle.text">y axis name</param>
        <module name="FlashChart"/>
    </module>

</module>  

</view>

sideview
SplunkTrust
SplunkTrust

That would be very cool if the charting framework could do that - if it could take two different fields RELEASEDATE and RELEASENAME, and use one for the major markers on the x-axis, and the other values for the minor-markers.

But I'm virtually certain that this is not possible. Someone else may surprise us here - it wouldn't be the first time that awesome functionality was deeply buried in the Splunk charting framework.

The good news is that I think you can get what you want by exploring charts like:

foo | chart count over RELEASEDATE by RELEASENAME   

and then graph that as a column chart. If you'd rather have the column bars stacked above eachother within a given RELEASEDATE, you can set charting.chart.stackMode to stacked.

NOTE: you're mixing simple-xml syntax inside your HiddenChartFormatter. Surprisingly I think the advanced XML wont throw any error, but it will be totally ignoring those <option> nodes. Replace them with equivalent <param> nodes if you want them to be used.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...